The issue that people raised over at reddit is that you have to trust the javascript code for local encryption/decryption...